Security & GDPR
UK-built. UK-hosted.Audited underneath.
Security and GDPR for a UK virtual data room. Exactly how 99 Data Rooms keeps your documents safe: where they live, who can reach them, the controls you hold, and the audited platforms it all runs on. No hand-waving.
Five layers, from the edge of the network to the record of what happened
- Hosting
- London, UK
- At rest
- AES-256
- In transit
- TLS 1.2+
- Data residency
- UK primary, EU backups
The perimeter.
Press a layer to read it. The one you are reading fills in as you go.
01Perimeter
The perimeter.
The website is delivered and shielded at the edge, and every API request is checked inside its own handler before anything is read.
- Hardened edgeOur control
Isolated edge runtime for server logic. Every public endpoint validates its own credential server-side on each request, with rate limiting and brute-force lockouts on the sensitive paths: one-time codes, passcodes, signing and contact.
- CloudflareWebsite edge & firewallSOC 2 Type IIISO 27001:2022ISO 27018ISO 27701PCI DSS L1
Website delivery and DNS, with a web application firewall and DDoS protection in front of every request to the site.
02Door
The door.
Who gets in, and how they prove it: the gates you set on every link, and a second factor for every account that turns it on.
- Controls on every linkOur control
Email gate, one-time-code verification, NDA acceptance, expiry, max views and one-click revocation.
- Two-factor authenticationOur control
TOTP two-factor with recovery codes. Turn it on and a password-only session cannot read your documents at all: the enforcement lives in Postgres row-level security across the data layer and storage, not in the app.
03Room
The room.
Once inside, a query can only see its own tenant's rows. The database enforces that, not the application.
- Row-level securityOur control
Every database query is scoped to your identity in Postgres. No cross-tenant leaks by construction, and a dedicated row-level-security test suite is run on changes before they are released.
- SupabaseData layerSOC 2 Type IIISO 27001
Database, storage, authentication and edge functions. Your documents and their data live here, in the London region.
The SOC 2 Type II and ISO 27001 reports above are held by Supabase and Cloudflare, the independently audited infrastructure providers 99 Data Rooms is built on. Primary data is resident in the UK (London); encrypted backups are held in an EU region. A Data Processing Agreement is available on request.
04Safe
The safe.
Where the bytes rest: encrypted, reachable only through short-lived signed URLs, and backed up daily and every 30 minutes.
- Encryption everywhereOur control
TLS 1.2+ in transit. AES-256 at rest for every stored document, handled by the platform.
- Short-lived signed URLsOur control
Storage is never public. Access is granted through signed URLs that expire in minutes, re-issued per view.
- Encrypted backupsOur control
Our database provider takes automatic daily backups. Every stored document is also copied to separate storage in an EU region on a 30-minute schedule, encrypted at rest. An additional nightly copy of the database to that offsite storage has been paused since 14 September 2026; this page will say when it resumes.
- Files are not scanned for malwareNot provided
We do not scan uploaded files for viruses or malware. Treat a file in a room as you would an email attachment: open it if you trust whoever shared it. The upload screens refuse macro-enabled Office files, including a macro file renamed to look like an ordinary one.
- Backups & recoveryResilienceAutomatedEncryptedEU region
Your primary data lives in the UK (London), with daily database backups by our database provider and every stored document copied to encrypted storage in an EU region.
05Ledger
The ledger.
What happened, kept: a page-by-page log per link, an audit page per signed document, and test suites run on changes before they are released.
- Audit trailOur control
A page-by-page visit log per share link, retained 24 months, visible in your own analytics. Signed documents carry their own audit page: every field value captured, with a per-field timestamp, signer IP and intent-to-sign consent.
- Tested before it shipsOur control
Changes are checked with typecheck, lint, build, backend and row-level-security test suites before they are released. Dependency updates are proposed automatically every week, and production dependencies are audited against published security advisories.
06AI assistants
How the AI surface is bounded.
A document in a data room can contain text written to be read by an AI assistant rather than by a person. If a member connects an assistant, it may act on that text. This is inherent to letting an assistant read documents at all, and we do not claim to prevent it. Nobody can. What we can do is bound what a compromised assistant is able to reach, so the blast radius is a permissions question rather than a trust question.
- It is only ever one memberEnforced in the database
An assistant acts as the member who connected it and can never exceed that member's own permissions. That is enforced in the database, on the path every tool call goes through, not in the agent and not in the application.
- Scope only narrowsConsent screen
A human picks which rooms an assistant may see, on a consent screen, after signing in with their second factor if their account has one turned on. That choice can only ever narrow what the database would already allow. It can never widen it.
- Nothing is silently overwrittenCompare-and-swap
Document writes are compare-and-swap against the version being edited. An instruction smuggled into a document cannot quietly overwrite a version somebody else is working on: a stale write is refused, and the refusal names the current version.
- The owner holds a switch and a logOff by default
AI access is off when a room is created and stays off until its owner turns it on. Turning it back off takes effect immediately, including for assistants already connected. Owners can read the log of automated access to their own rooms.
07Compliance and disclosure
Plainly, and in writing.
Compliance, plainly
- UK GDPR and Data Protection Act 2018 aligned
- Runs on SOC 2 Type II and ISO 27001 platforms (Supabase and Cloudflare)
- Primary data stored in the UK (London), encrypted backups in an EU region; DPA on request
- Full data export and self-serve account deletion; encrypted backups age out within 30 days
- International transfers covered by Standard Contractual Clauses and the UK International Data Transfer Addendum (see the DPA)
- No third-party trackers running on your viewers
DPA available on request, see /legal/dpa. For the buyer-facing collection of all of this - controls, certifications status and document requests - see the trust centre.
Responsible disclosure
Found a vulnerability?
Email alerts@99developer.com with reproduction steps, or start from /.well-known/security.txt. We acknowledge within one business day and put critical issues ahead of all other work. No bounty yet, but we will credit you.
Try it on a document that matters. Open a room, send one gated link and read the audit trail yourself. 3 rooms and 25 active links stay free, with no card.
“Security on a document-sharing product is a hygiene bar, not a marketing one. We publish what we actually do, name the platforms we stand on, and sign a DPA on request.”